Dependency Analysis of the Extra-Functional Properties of the Time-Triggered Architecture

Abstract

The time-triggered paradigm has proven highly suitable for closed safety-critical distributed real-time systems with predetermined configurations and stringent timeliness and dependability requirements. The Time-Triggered Architecture (TTA) embodies this paradigm by combining a globally synchronized time base, offline-defined schedules, and architectural services that collectively provide key extra-functional properties, including determinism, temporal predictability, fault containment, and composability. While the TTA is successfully deployed across the avionics, space, rail, and automotive sectors, modern safety-critical systems are increasingly expected to support functionalities of different criticalities, higher levels of connectivity, long and untended operational lifetimes, and resilience against sophisticated cyber threats, motivating a transition toward open and highly interconnected platform architectures. Evolving the TTA to address these emerging requirements is fundamentally challenged by the rigidity of time-triggered operation and the tight coupling among its architectural services and mechanisms. Consequently, modifying or replacing individual services can unintentionally weaken its extra-functional properties. A systematic understanding is therefore required of how individual design decisions contribute to the emergence of these properties and which of these decisions are essential for preserving them. Prior work, however, has primarily focused on individual mechanisms rather than the architecture as a whole. In this paper, we address this gap through a qualitative architectural analysis of TTA’s architectural services and the resulting extra-functional properties. The analysis enables system architects seeking to evolve the TTA to reason about the trade-offs involved in achieving these properties by distinguishing inherent architectural constraints from those arising from implementation choices. For this purpose, we introduce a classification framework that categorizes the dependencies between architectural services and extra-functional properties as fundamental, implementation-based, or application-dependent. Our analysis shows that most dependencies are implementation-based or application-dependent rather than fundamental, revealing substantial design space for architectural adaptation while preserving TTA’s core safety guarantees.